Privacy Policy

Last updated November 4, 2026

Hodolog is a travel planner and travel log run by Orangiraffe LLC. This page says what we keep about you, why, who else is involved, and how to get it all back or deleted. Questions: support@hodolog.com.

Counting Visits

We count visits to Hodolog ourselves, with no cookies and no outside analytics service. For each page opened we keep the page, the day, the site or campaign that sent you (from the link or the referrer, never your search words), the kind of device, your browser language and whether you were signed in.
To tell visits apart we keep a daily code made from your address and browser and a secret on our server. It changes every day and cannot be turned back into your address or linked to your account. We keep these counts for 400 days, then delete them.
We also keep the country your address belongs to at the moment of the visit, looked up on our own server in a free country database (see Data sources and credits). Only the country is kept, never the address, and nothing is sent to anyone else for it.
When you ask for access, we note on the request the label of the site or campaign that sent your visit (for example the name of a search engine), so we can see which sources bring people who join. Nothing else about the visit is attached to your request. We also work out, from account dates, how many people come back after a week, a month or three months, and how soon they make a first trip; these are counts of groups of accounts.

What We Keep

Your account: name, email address, and your password stored only as a one-way hash (we cannot read it).
Your profile, if you fill it in: photo, home town, country, home airport, a short bio, how you travel, and your units.
Your trips: names, dates, places, flights, stays, getting around, activities, costs, notes, packing lists, ideas for the trip and the votes on them, polls and their answers, cover photos, and links to photo albums that live elsewhere.
Cover and profile photos are resized and saved without their hidden details (no location, no camera data).
Logos you add for a company (a hotel, an airline) on your entries: redrawn as a small picture and kept privately, so only you see them, until you remove them or delete your account.
Documents you attach to a trip or one of its entries (PDFs and pictures, such as boarding passes and vouchers): stored encrypted with a cloud storage provider in the United States, as you sent them, except that pictures are saved again without their hidden details. The files are never public: our server checks who may see each one before it opens. They open only for people who can see that entry (on the trip itself, its owner and travelers), and they are deleted when you or the trip's owner delete them, when the entry or the trip is deleted, when you leave the trip, or with your account. Documents are also deleted automatically 12 months after the trip ends (or 30 days after, if you choose that in Settings), after an email warning, unless you mark one to keep. A deleted file is removed from storage within hours (a clean-up runs every few hours). Download my data lists their names and sizes.
Expense reports on business trips, if you use them: the expense lines you add (date, category, description, merchant, amounts, payment method, and the distance or days and rate of mileage and per diem), the changes you make to your entries in the report, the business purpose you write, and the receipts you attach. Only you see your report and your receipts. Receipts are stored like documents but are never deleted automatically, because they are your records for taxes: they stay until you delete them, their line, the entry or the trip, leave the trip, or delete your account. Download my data includes your lines and the names and sizes of your receipts.
Finding past trips: your photos are read in your own browser and never uploaded. For photos taken on trips, we save where and when exactly they were taken (each group of photos taken together: its position and its time, to the minute), so your travel log can show, for example, 10:42, Eiffel Tower. Your homes are saved only roughly (about 1 km), and nothing is saved about photos taken at home. We also save the towns we name from them and, unless you leave them out, the photos' file names. Activity start points from your fitness app are read only with a key you create in that app.
Routes of your activities: if you ask for them with a key you create in your fitness app, we save the routes (the line covered, its date, start time, kind, distance and time) of your activities on your trips' days only, and never those within 80 km of your homes, plus the names of sights along them. They are kept privately (only you see them), until you delete them (Settings, where you got them) or your account. The key is used once and never kept.
Routes recorded by the phone app (Premium), only on trips where you turn it on: while recording, your phone sends us its position about every 250 m as you move (or about every kilometre in Low mode), with the time and how precise it was, also when the app is closed. We use them to draw your route on the trip, the distance of each day and the places you visited. The raw points are deleted 30 days after your last day of the trip; a compact line of each day, its distance and the places visited stay with the trip. Only you see them unless you choose the trip's people or its guests. They are never on the trip's public link, never in what others download and never on your profile. They go when you delete them, leave the trip, the trip is deleted, or you delete your account, and they are in Download my data. If you delete a stop, or any part of a recorded route, we remove it and the line around it and keep only its position, until 45 days after the trip ends (or after you deleted it, if later), so that a late upload from your phone cannot bring it back; then that position is deleted too.
Your journal: the notes and posts you write on your trips and in Journals, and the links to photos you add to them (those photos stay where they are; we never copy them). Photos you pick from your phone or from Google Photos for a journal entry are kept by us: they are made smaller on your device first (at most 2048 pixels on the longest side) and saved again without their location or camera details, stored with a cloud storage provider in the United States, and shown only to the people who can see that entry. They are deleted with the entry or your account; a photo you picked but never saved into an entry is deleted after a day. When you are no longer on a trip, or it is deleted, your journal of it stays in Journals with the trip's name and dates, seen only by you (unless you chose to delete it when leaving).
Booking emails you forward to trips@hodolog.com: the bookings read from them. We accept them only from your sign-in address or another address you confirmed with a link we sent to it, and only when the sender's email provider proves the email came from that address; addresses you add are kept with your account until you remove them. The email itself is never stored; its text is kept only until you handle it, 30 days at most. With Premium, the text of an email that was added to a trip is kept for up to 30 days after it arrived, so it can be read again; it is then deleted. An AI service reads the text of each email you forward (see Services we use). From what the AI finds, and when your own AI assistant reads one for you, Hodolog keeps how that company lays out its emails (a few words before a date or a code, and how dates are written), not the dates or codes themselves, so Hodolog's own rules can read the next one by itself. What was learned from your emails stays with your account until another person's email shows the same layout, and goes when you delete your account.
Your Vault: loyalty numbers are stored encrypted, with the key kept apart from the database. A loyalty number of yours found in a booking email you forward (your name on the booking) is added to your Vault the same way. Travel IDs (passports, yours and those of people you look after, Known Traveler, Redress) are encrypted on your own device with a key made there from your Hodolog password. A passport photo you use to fill in a passport is read on your device and is never sent to us or kept. Your password reaches our server only to check it (when you sign in, change it or set up your Vault), and is never stored (only a one-way hash); the key is never sent. So what we store cannot be read without your password. Changing your password keeps them; a forgotten password cannot open them.
The countries of your passports: when you save or remove a passport in your Vault, your device tells our server only the issuing countries of the passports you hold, and for a dependent's passport also their first name (never the number, full names or dates), so the visa and entry checks on your trips and in the travel guides use your passports, and a dependent on a trip gets checks for theirs. They stay until you remove the passport, start your travel IDs over or delete your account, and they are in Download my data.
Passport expiry alerts and renewal reminders, only if you turn them on in your Vault: for each passport, whose it is (you, or the first name of a person you look after), its issuing country and its expiry date are stored readable by our server, so we can email you 12, 9 and 6 months before a passport expires and your To do can warn you when a trip ends less than 6 months before an expiry. Never the number or other details. Turning the alerts off deletes them.
UNESCO World Heritage sites you have visited are worked out from your own trips, places and photo moments each time you open the map; only the sites you mark yourself (I have been here, or Not been) are stored, with your account.
Your garage, if you use it (Premium): the cars you add (a nickname, make, model and year, and a logo if you add one) and their odometer readings, and the distance your recorded routes add to a car on a day you drove it. Only you see them. They go when you delete a car or your account, and they are in Download my data.
Your notification choices (which messages reach you by push on your phone or by email, and the quiet hours), and the time zone your device or browser reports, kept with your account so reminders arrive at sensible hours. We also keep a note of which reminders were already sent so none is sent twice.
Two-factor sign-in, if you turn it on: the secret your authenticator app shares with us is stored encrypted, and your recovery codes only as one-way hashes.
When you last signed in and last used the site, so Hodolog's team can manage accounts.
If you ask to join: the name, email and note you send, until the admin decides. A request that is declined keeps only the email address, so the same address cannot ask again.
Our server's logs record the internet address and time of each visit, to keep the site safe and find errors. They are replaced as they fill up, usually within a few weeks. To stop password guessing, attempts to sign in, sign up or reset a password are counted by internet address and email for up to 2 days.
A record of what Hodolog's team does on accounts (for example approving a request), and of important changes to your own account (a password reset, a new sign-in email), for safety. Entries are deleted after 24 months.
Problem reports you send with the bug button: what you write, the page you were on, your browser and screen size, and a screenshot if you choose to send one (you see it first). Only you and Hodolog's support team see them. They are kept while your account exists, and go when you delete it.
Reports and blocks: who you block (only you see the list; it goes when you delete your account), and reports you make about a profile or a public journal page: your reason and note, and for a journal page the text it showed at that moment. Only Hodolog's support team sees them. Closed reports are deleted after 90 days. A person you report is never told who reported them.

Who Can Use Hodolog

You must be 16 or older to have an account. We do not knowingly keep data about anyone younger; if we learn that we do, we delete it. Trips may name children who travel with you (as a name only, with no account); that is your choice as the person who adds them.

Who Sees It

A trip is seen by its owner, its travelers with an account, and its viewers (people it is shared with). Entries marked private are seen only by the people they are for. Booking codes are seen only by whoever added them. Viewers see a trip's costs and booking codes only if the trip's owner, or the person who invited them, allows it.
Your journal: each note or post is seen only by you, or by the trip's people, as you choose for it. If you make a public link to your journal of a trip, anyone with that link can read the notes and posts you marked for the public page (never your costs, booking codes, emails or homes). Search engines are asked not to list it. Making a new link or stopping sharing ends the old link at once.
A trip's public link: if a trip's owner makes one, anyone with it can see the trip's name, photo, dates, places and a map of them, without an account. Never its bookings, booking codes, costs, people, notes, journal entries (unless the owner links their own public journal), photo positions or homes. Search engines are asked not to list it, and only the owner can make a new link or stop sharing, which ends the old link at once.
Packing lists are seen by their maker and the people on the trip they share them with, never by a trip's viewers.
Your profile: people signed in to Hodolog can find your name and photo and send you a friend request. Friends also see a map of the places you visited (never your homes) and the names of your latest trips (never their dates). In Your profile, Public profile, you choose: not findable, findable with the rest for friends only (the default), or a public profile for anyone signed in, and whether the map and the trip names show. Your email never shows, and your list of friends is only yours.
Hodolog's team manages accounts and requests to join. It does not browse your trips. To help with a problem, Hodolog's support may view your account as you see it, read only: nothing can be changed while they do, each view ends within 30 minutes, and every view (who, when and which pages) is recorded. Your travel IDs cannot be read (they are encrypted on your device) and your loyalty numbers are not shown.
We do not sell your data or show ads, and we use no outside tracking or analytics tools. We count visits to our own pages ourselves, without cookies (see Counting visits).

Services We Use

Hodolog runs on a server we rent in a data center. A few outside services help it work; none gets your name or account unless said here.
Email: an email delivery service sends our emails (invites and account emails), so it sees the address and the message. Our domain's email forwarding passes mail sent to trips@hodolog.com on to our server.
AI reading of booking emails: when you forward a booking email to trips@hodolog.com, the text of that email (and of PDF tickets attached to it) is sent to Anthropic, an AI service provider in the United States, which returns the bookings it finds. That text can contain what the email shows: names, booking codes, loyalty numbers and prices. Nothing else is sent: not your account, your other emails, your trips or your Vault. Under the provider's business terms it may not train its models on what we send. What it finds goes into your trip marked New (or waits in your inbox when it is not clear which trip it belongs to) so you can check it. AI can make mistakes, so check every detail. An email that already carries its booking in a form computers read is read by Hodolog itself and is not sent, and when the AI is paused or its daily limit is reached Hodolog's own rules read the email instead. If you do not want an email read this way, do not forward it, or add the booking by hand.
AI features (Premium): trip plans and changes, packing help, journal drafts, quick help on Today and scanning a receipt in a business trip's expense report use Anthropic's Claude AI model. They work only after you agree to it in the app or on the site (you can withdraw in Settings, Data). When you use one, what you typed or picked and the trip details the answer needs (places, dates, what is already planned and the addresses of your stay and plans, the names of places where your own photos were taken for a journal draft (never the photos or their positions), the weather, nearby places from our travel guides), and, when you scan a receipt, the photo of that receipt (with the trip's dates and places, to read its date and currency) are sent to Anthropic in the United States. Never your password, Vault, travel IDs, payment details or booking codes. Under Anthropic's business terms it may not train its models on what we send. We keep your requests and the answers for 30 days, so an answer you report can be checked, then delete them (a report keeps its own copy until it is closed and deleted after 90 days, or until you delete your account); they are in Download my data. Nothing an AI feature suggests is added to your trip until you accept it. AI can be wrong: check what it suggests, and check entry rules and health advice with official sources.
Push notifications on your phone, if you turn them on in the app: the app gives us a device token, which we keep with your account, and we ask Expo's push service and then Apple or Google to deliver each notification. They see the token and the text of the notification, for example the airports and number of a flight, or that a payment is waiting for you to confirm. Payment messages carry only a first name, never a trip. Turn them off in Settings, Notifications on this phone; the token is also removed when you sign out of the app, when your password is reset or you are signed out everywhere, and when you delete your account.
Maps and places: map pictures come from a map service; the place search goes from your browser straight to an OpenStreetMap search service. To draw routes we send pairs of map positions only, never who you are, to route services for roads and train tracks.
Weather and stock photos: we ask weather services for the weather at a trip's places and dates, and a photo library for cover photos by a trip's place names. Nothing about you is sent.
Google Photos: if you choose a trip photo from Google Photos, you sign in with Google and pick the photo in Google's own picker. Hodolog asks only for permission to see the photos you pick. It copies the one photo you picked, once, to use as that trip's photo (resized, with location and camera details removed), and keeps neither that permission, nor your Google account details, nor anything else from your library. The photo is shown to people who can see the trip and on past trips listed on the profiles of the people on it. It is never sold, shared for advertising or used to train AI models, and it is deleted when it is removed or replaced, or the trip is deleted (copies in our nightly backups are gone within 14 days). You can also remove Hodolog's access at any time in your Google Account, under Security, Your connections to third-party apps and services.
Hodolog's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Tours and tickets: where Hodolog shows tours and tickets for a place, our server asks Viator (a Tripadvisor company) for the tours of the nearest destination. It sends only that destination, your filters and a campaign code that is the same for everyone; never your name, email or account. Viator's product information is shown only to signed-in people, is kept in our server's memory for 15 minutes, and is never part of a public page, an export, a calendar or an email. When you add a tour to a plan, we keep a short summary of it (its name, from price, rating, picture and the link to Viator) with that entry until you remove the entry. Booking happens on viator.com, under Viator's own terms and privacy policy; Hodolog never takes a payment or sees your booking, and may earn a commission if you book through our links.
Logos in your Vault: our server fetches a known company's icon by the company's web address only, and keeps it.
Links you open to airlines or flight trackers go to those sites, under their own privacy terms. If you give a Hodolog file to your own AI assistant, that assistant's privacy terms apply to what you give it.

Cookies

One cookie keeps you signed in, and one remembers your time zone so dates show right. The key that opens your travel IDs is kept on your device until you sign out there or your session ends. Nothing else.

Security

Everything travels encrypted (HTTPS). Passwords are hashed. Nightly backups are encrypted and kept for 14 days.

How Long We Keep It

Your account and trips: until you delete them or your account. An account nobody uses is not deleted on its own; you can delete it at any time.
Booking email text: until you handle the email, 30 days at most. Password reset links: an hour (removed within a day). Email confirmation links: a day. Invite links: 7 days; a trip's invite link is kept for 90 days after it ends, or while someone who joined with it is on the trip. Backups: 14 days.

Where It Is

Hodolog is run from the United States by Orangiraffe LLC, and your data is processed there. If you use Hodolog from another country, you agree to that transfer.

Your Rights

Wherever you live, you can see, download, correct and delete your data, and ask us to stop using it, from your profile or by writing to support@hodolog.com. We answer within 30 days. If you are in the European Union, the United Kingdom or California, the laws there give you these rights too, and you can complain to your data protection authority.
We use your data only to run Hodolog for you (our contract with you), to keep it safe (our legitimate interest), and where the law requires.

If Something Goes Wrong

If your data is ever exposed by a breach, we will tell you and the authorities as the law requires, without delay.

Your Choices

Your profile, Settings, Download my data: one file with everything we keep about you.
Your profile, Settings, Delete my account: deletes your account and data for good, after you choose what happens to your trips that others are on. Copies in our backups are gone within 14 days.
You can change or remove anything in your trips, profile and Vault at any time.

Location Data

Hodolog collects location in two ways, and only for features you turn on.
Recording your route (Premium, phone app, only on trips where you turn on Record my route): while recording is on, the app collects your phone's precise location about every 250 meters or 5 minutes (less often in Low mode or when the battery is low), including in the background and when the app is closed or not in use. On Android, a notification stays visible while it records. We use it to draw your route, to work out the distance of each day and the places you visited, and to fill the days of your trip and journal. It is sent to our servers in small batches. Raw points are deleted 30 days after the last day of the trip; the compact route line is kept with the trip until you delete the trip, your recording or your account.
Who sees it: only you by default. You can choose to share a recording with the people on the trip. We never sell it, never use it for advertising and never share it with advertisers or data brokers.
Your control: you choose whether to allow location in your phone's settings, and you can pause or stop recording at any time in the app, or turn it off for a trip. Settings, Delete my recorded route removes it from our servers. Turning location off in your phone stops all collection.
Photo positions (Find trips): when you ask Hodolog to find past trips from your photos, the app reads the time and position stored in your photos on your phone. This is worked out on your phone; the photos themselves are never uploaded. Only the places you choose to save are kept, as described above.

Changes

If this policy changes, we will say so on this page and update the date above.

Data Sources and Credits

Weather forecasts: MET Norway (CC BY 4.0) Data from MET Norway, combined into daily summaries by Hodolog.
Exchange rates: Frankfurter US dollar amounts of costs in other currencies, and the currency converter on Today, use Frankfurter's daily reference rates, gathered from central banks and other official sources, as an estimate.
Suggested places to visit: OpenStreetMap contributors (ODbL) Places near a trip come from OpenStreetMap (read through the Overpass API) and from Wikipedia articles near the point, with their names and one-line descriptions from Wikidata (CC0).
Tours and tickets: Viator Tours and tickets shown in Hodolog come from Viator, a Tripadvisor company, with ratings from Viator and Tripadvisor. They are shown only to signed-in people and are booked on viator.com. Hodolog may earn a commission if you book through these links.
UNESCO World Heritage sites: Wikidata (CC0) The list of World Heritage sites on the map, with their positions, years and types, comes from Wikidata. Each site links to its own page on UNESCO's World Heritage Centre site (whc.unesco.org).
Visitors' countries in our own visit counts: IP Geolocation by DB-IP (CC BY 4.0) The country of a visit comes from DB-IP's free IP to Country Lite database, kept and read on our own server.
Night lights map: NASA Earth Observatory and NASA GIBS The Night lights map picture is NASA's Black Marble (public domain), served by NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
Past and usual weather: NASA POWER These data were obtained from the NASA Langley Research Center POWER Project funded through the NASA Earth Science Directorate Applied Science Program.
Elevation for Play the trip in 3D and the shaded relief: Terrain Tiles on AWS Open Data Your device reads these tiles straight from Amazon Web Services, which sees your internet address as any website does. Sources: ArcticDEM terrain data DEM(s) were created from DigitalGlobe, Inc., imagery and funded under National Science Foundation awards 1043681, 1559691, and 1542736; Australia terrain data © Commonwealth of Australia (Geoscience Australia) 2017; Austria terrain data © offene Daten Österreichs: Digitales Geländemodell (DGM) Österreich; Canada terrain data contains information licensed under the Open Government Licence, Canada; Europe terrain data produced using Copernicus data and information funded by the European Union - EU-DEM layers; Global ETOPO1 terrain data U.S. National Oceanic and Atmospheric Administration; Mexico terrain data source: INEGI, Continental relief, 2016; New Zealand terrain data Copyright 2011 Crown copyright (c) Land Information New Zealand and the New Zealand Government (All rights reserved); Norway terrain data © Kartverket; United Kingdom terrain data © Environment Agency copyright and/or database right 2015. All rights reserved; United States 3DEP (formerly NED) and global GMTED2010 and SRTM terrain data courtesy of the U.S. Geological Survey.
The shaded relief on the website's maps: Esri World Hillshade Sources: Esri, Vantor, Airbus DS, USGS, NGA, NASA, CGIAR, N Robinson, NCEAS, NLS, OS, NMA, Geodatastyrelsen, Rijkswaterstaat, GSA, Geoland, FEMA, Intermap, and the GIS user community. Asked by our server, like the rest of the map.
The 3D city map in the Android app, and the buildings in the street-level close-ups of Play the trip in 3D: OpenFreeMap (ODbL) Vector map tiles from OpenFreeMap (© OpenMapTiles, data © OpenStreetMap contributors). Your phone or browser reads them straight from OpenFreeMap, which sees your internet address as any website does.